Add minimal testing for the PRIVATEDNS algorithm mapping

Enable the example PRIVATEDNS mappings (rsasha256.example.org and
rsasha512.example.org) in developer builds via TEST_PRIVATEDNS and use
them to test dst_algorithm_fromdata().

The test algorithms take the DST algorithm numbers 258 and 259, so
DST_MAX_ALGS has to grow to cover them: arrays sized by it are indexed
with the numbers dst_algorithm_fromdata() returns, and a value past the
bound would overflow them. Also map the new numbers back to
DNS_KEYALG_PRIVATEDNS in dst_algorithm_tosecalg() so the round trip
stays consistent.

diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index c84a7f9ba36ee128daf648de1a574d32c0cb37f3..451e3da3857d34214438a1393d8d10b82335efa2 100644 (file)
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -2604,6 +2604,10 @@ dst_algorithm_tosecalg(dst_algorithm_t dst_alg) {
        static dns_secalg_t dns_alg[DST_MAX_ALGS] = {
                [DST_ALG_RSASHA256PRIVATEOID] = DNS_KEYALG_PRIVATEOID,
                [DST_ALG_RSASHA512PRIVATEOID] = DNS_KEYALG_PRIVATEOID,
+#if TEST_PRIVATEDNS
+               [DST_ALG_RSASHA256PRIVATEDNS] = DNS_KEYALG_PRIVATEDNS,
+               [DST_ALG_RSASHA512PRIVATEDNS] = DNS_KEYALG_PRIVATEDNS,
+#endif
        };
 
        if (dst_alg < 256) {

diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index bb24b63c07a8270d23918113ca29eefb77305d0f..efbd99a6289459d8bc0c0618042a0dda30609d00 100644 (file)
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -118,7 +118,13 @@ typedef enum dst_algorithm {
         */
        DST_ALG_RSASHA256PRIVATEOID = 256, /* 1.2.840.113549.1.1.11 */
        DST_ALG_RSASHA512PRIVATEOID = 257, /* 1.2.840.113549.1.1.13 */
+#ifdef TEST_PRIVATEDNS
+       DST_ALG_RSASHA256PRIVATEDNS = 258, /* rsasha256.example.org. */
+       DST_ALG_RSASHA512PRIVATEDNS = 259, /* rsasha512.example.org. */
+       DST_MAX_ALGS = 260,
+#else
        DST_MAX_ALGS = 258,
+#endif
 } dst_algorithm_t;
 
 /*% 'Type' for dst_read_key() */

diff --git a/meson.build b/meson.build
index 88e554e559725548286467c1480af4f7c67a1e92..c3644cf6a2ae1c6b453ae4f3203dfa9175e1ae1e 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -359,6 +359,7 @@ if developer_mode
     config.set('ISC_SOCKET_DETAILS', 1)
     config.set('ISC_STATS_CHECKUNDERFLOW', 1)
     config.set('DNS_TYPEPAIR_CHECK', 1)
+    config.set('TEST_PRIVATEDNS', 1)
 endif
 
 # mandatory builtins

diff --git a/tests/dns/dst_test.c b/tests/dns/dst_test.c
index d74d693de581c37493d7c9b0f03681bacde3c64e..73871677e7c508b56dcb824d69b679b56fe0f488 100644 (file)
--- a/tests/dns/dst_test.c
+++ b/tests/dns/dst_test.c
@@ -62,6 +62,16 @@ ISC_RUN_TEST_IMPL(algorithm_fromdata) {
                /* An unsupported private dns algorithm */
                FROMDATA(DNS_KEYALG_PRIVATEDNS, 0, 0x04, 't', 'e', 's', 't',
                         0x00),
+#ifdef TEST_PRIVATEDNS
+               FROMDATA(DNS_KEYALG_PRIVATEDNS, DST_ALG_RSASHA256PRIVATEDNS,
+                        0x09, 'r', 's', 'a', 's', 'h', 'a', '2', '5', '6',
+                        0x07, 'e', 'x', 'a', 'm', 'p', 'l', 'e', 0x03, 'o',
+                        'r', 'g', 0x00),
+               FROMDATA(DNS_KEYALG_PRIVATEDNS, DST_ALG_RSASHA512PRIVATEDNS,
+                        0x09, 'r', 's', 'a', 's', 'h', 'a', '5', '1', '2',
+                        0x07, 'e', 'x', 'a', 'm', 'p', 'l', 'e', 0x03, 'o',
+                        'r', 'g', 0x00),
+#endif
 
                /* length byte + 1.2.840.113549.1.1.11 BER encoded RFC 4055 */
                FROMDATA(DNS_KEYALG_PRIVATEOID, DST_ALG_RSASHA256PRIVATEOID,
@@ -83,6 +93,10 @@ ISC_RUN_TEST_IMPL(algorithm_fromdata) {
                alg = dst_algorithm_fromdata(fromdata[i].secalg,
                                             fromdata[i].data, fromdata[i].len);
                assert_int_equal(alg, fromdata[i].dstalg);
+               if (alg != 0) {
+                       assert_int_equal(dst_algorithm_tosecalg(alg),
+                                        fromdata[i].secalg);
+               }
        }
 }